there are more than one reasons for an audit record to be cut. For example, if access is granted by a PERMIT command having specified ACTION(AUDIT), an audit record is written, when a user accesses that resource, granted by that PERMIT command.